← Back

Mozilla

mozilla

3,934 CVEs • 44 products

Products (44)

Click to collapse
Toggle
Firefox
firefox
3,473 CVEs
Thunderbird
thunderbird
2,068 CVEs
Seamonkey
seamonkey
704 CVEs
Firefox Esr
firefox_esr
487 CVEs
Thunderbird Esr
thunderbird_esr
228 CVEs
Bugzilla
bugzilla
145 CVEs
Mozilla
mozilla
108 CVEs
Firefox Mobile
firefox_mobile
87 CVEs
Network Security Services
network_security_services
50 CVEs
Mozilla Suite
mozilla_suite
27 CVEs
Firefox Focus
firefox_focus
20 CVEs
Focus
focus
16 CVEs
Firefox Os
firefox_os
14 CVEs
Nss
nss
6 CVEs
Bleach
bleach
5 CVEs
Bonsai
bonsai
4 CVEs
Camino
camino
4 CVEs
Vpn
vpn
4 CVEs
Netscape Portable Runtime
netscape_portable_runtime
3 CVEs
Convict
convict
3 CVEs
Nunjucks
nunjucks
2 CVEs
Mozjpeg
mozjpeg
2 CVEs
Webthings Gateway
webthings_gateway
2 CVEs
Pollbot
pollbot
2 CVEs
Geckodriver
geckodriver
2 CVEs
Gecko
gecko
1 CVE
Durian Web Application Server
durian_web_application_server
1 CVE
Geckb
geckb
1 CVE
Libxul
libxul
1 CVE
Zamboni
zamboni
1 CVE
Firefoxos
firefoxos
1 CVE
Persona
persona
1 CVE
Hubs Cloud Reticulum
hubs_cloud_reticulum
1 CVE
Hubs Cloud
hubs_cloud
1 CVE
Mozilla Vpn
mozilla_vpn
1 CVE
Nss Esr
nss_esr
1 CVE
Hawk
hawk
1 CVE
Common Voice
common_voice
1 CVE
Sccache
sccache
1 CVE
Neqo
neqo
1 CVE
Rhino
rhino
1 CVE
0din Scanner
0din_scanner
1 CVE
Thin Vec
thin-vec
1 CVE
Klar
klar
1 CVE

CVEs (3,934)

CVE
VENDORS
PRODUCTS
UPDATED
PUBLISHED
CVSS
CVE-2026-12295
1Mozilla
2Firefox
Thunderbird
Oct 26, 2026
Jun 16, 2026
N/A· v4
9.6 CRITICAL· v3
N/A· v2
Sandbox escape in the DOM: Navigation component. This vulnerability was fixed in Firefox 152, Firefox ESR 140.12, Firefox ESR 115.37, Thunderbird 152, and Thunderbird 140.12.
CVE-2026-12294
1Mozilla
2Firefox
Thunderbird
Oct 26, 2026
Jun 16, 2026
N/A· v4
9.6 CRITICAL· v3
N/A· v2
Sandbox escape in the DOM: Workers component. This vulnerability was fixed in Firefox 152, Firefox ESR 140.12, Firefox ESR 115.37, Thunderbird 152, and Thunderbird 140.12.
CVE-2026-12293
1Mozilla
2Firefox
Thunderbird
Oct 26, 2026
Jun 16, 2026
N/A· v4
9.8 CRITICAL· v3
N/A· v2
Use-after-free in the Graphics: WebGPU component. This vulnerability was fixed in Firefox 152 and Thunderbird 152.
CVE-2026-12292
1Mozilla
2Firefox
Thunderbird
Oct 26, 2026
Jun 16, 2026
N/A· v4
8.1 HIGH· v3
N/A· v2
Incorrect boundary conditions in the Web Audio component. This vulnerability was fixed in Firefox 152, Firefox ESR 140.12, Thunderbird 152, and Thunderbird 140.12.
CVE-2026-12291
1Mozilla
2Firefox
Thunderbird
Oct 26, 2026
Jun 16, 2026
N/A· v4
8.8 HIGH· v3
N/A· v2
Use-after-free in the Networking: HTTP component. This vulnerability was fixed in Firefox 152, Firefox ESR 140.12, Firefox ESR 115.37, Thunderbird 152, and Thunderbird 140.12.
CVE-2026-12290
1Mozilla
2Firefox
Thunderbird
Oct 26, 2026
Jun 16, 2026
N/A· v4
8.1 HIGH· v3
N/A· v2
Memory safety bug fixed in Thunderbird 152. This vulnerability was fixed in Firefox 152, Firefox ESR 140.12, Firefox ESR 115.37, Thunderbird 152, and Thunderbird 140.12.
CVE-2026-12289
1Mozilla
2Firefox
Thunderbird
Oct 26, 2026
Jun 16, 2026
N/A· v4
8.8 HIGH· v3
N/A· v2
Privilege escalation in the Graphics: WebRender component. This vulnerability was fixed in Firefox 152, Firefox ESR 140.12, Firefox ESR 115.37, Thunderbird 152, and Thunderbird 140.12.
CVE-2026-11799
1Mozilla
2Focus
Klar
Jun 17, 2026
Jun 9, 2026
N/A· v4
7.5 HIGH· v3
N/A· v2
UXSS in Focus for iOS / Klar Webkit navigation. This vulnerability was fixed in Focus for iOS 151.3.1 and Klar for iOS 151.3.1.
CVE-2026-10702
1Mozilla
1Firefox
Jul 22, 2026
Jun 2, 2026
N/A· v4
7.5 HIGH· v3
N/A· v2
JIT miscompilation in the JavaScript Engine: JIT component. This vulnerability was fixed in Firefox 151.0.3.
CVE-2026-10701
1Mozilla
1Firefox
Jul 22, 2026
Jun 2, 2026
N/A· v4
7.5 HIGH· v3
N/A· v2
Incorrect boundary conditions in the Graphics: Text component. This vulnerability was fixed in Firefox 151.0.3.
CVE-2026-9309
1Mozilla
1Firefox
Jul 22, 2026
Jun 1, 2026
N/A· v4
5.4 MEDIUM· v3
N/A· v2
Firefox for iOS Reader View did not properly escape HTML tags in JSON-LD metadata. A malicious page could inject markup that changed Reader View behavior and leaked sensitive URL parameters. These parameters could then b...Show more
Firefox for iOS Reader View did not properly escape HTML tags in JSON-LD metadata. A malicious page could inject markup that changed Reader View behavior and leaked sensitive URL parameters. These parameters could then be used to access internal pages, potentially resulting in arbitrary JavaScript execution in an internal origin. This vulnerability was fixed in Firefox for iOS 151.2.Show less
CVE-2026-9308
1Mozilla
1Firefox
Jul 22, 2026
Jun 1, 2026
N/A· v4
5.4 MEDIUM· v3
N/A· v2
Firefox for iOS Reader View replaced page content in its HTML template before replacing other internal placeholders. A malicious page could include a placeholder string that was later substituted with JSON-LD data, poten...Show more
Firefox for iOS Reader View replaced page content in its HTML template before replacing other internal placeholders. A malicious page could include a placeholder string that was later substituted with JSON-LD data, potentially resulting in arbitrary JavaScript execution. This vulnerability was fixed in Firefox for iOS 151.2.Show less
CVE-2026-9078
1Mozilla
1Firefox
Jul 23, 2026
May 25, 2026
N/A· v4
5.4 MEDIUM· v3
N/A· v2
Firefox for iOS displayed specially crafted right-to-left (RTL) and internationalized domain names (IDNs) incorrectly in link preview UI surfaces. A crafted RTL hostname could visually reorder portions of the displayed d...Show more
Firefox for iOS displayed specially crafted right-to-left (RTL) and internationalized domain names (IDNs) incorrectly in link preview UI surfaces. A crafted RTL hostname could visually reorder portions of the displayed domain, causing attacker-controlled sites to appear as trusted origins. This vulnerability was fixed in Firefox for iOS 151.1.Show less
CVE-2026-8706
1Mozilla
1Firefox
Jul 23, 2026
May 19, 2026
N/A· v4
6.5 MEDIUM· v3
N/A· v2
Firefox for iOS hosted Reader mode on an unauthenticated local web server, allowing another application on the same device to request arbitrary URLs and receive the response rendered with the signed-in user's cookies. Th...Show more
Firefox for iOS hosted Reader mode on an unauthenticated local web server, allowing another application on the same device to request arbitrary URLs and receive the response rendered with the signed-in user's cookies. This vulnerability was fixed in Firefox for iOS 151.0.Show less
CVE-2026-8975
1Mozilla
2Firefox
Thunderbird
Oct 21, 2026
May 19, 2026
N/A· v4
8.8 HIGH· v3
N/A· v2
Memory safety bugs present in Thunderbird 140.10 and Thunderbird 150. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrar...Show more
Memory safety bugs present in Thunderbird 140.10 and Thunderbird 150. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability was fixed in Firefox 151, Firefox ESR 115.36, Firefox ESR 140.11, Thunderbird 151, and Thunderbird 140.11.Show less
CVE-2026-8974
1Mozilla
2Firefox
Thunderbird
Oct 21, 2026
May 19, 2026
N/A· v4
8.8 HIGH· v3
N/A· v2
Memory safety bugs present in Thunderbird 140.10 and Thunderbird 150. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrar...Show more
Memory safety bugs present in Thunderbird 140.10 and Thunderbird 150. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability was fixed in Firefox 151, Firefox ESR 140.11, Thunderbird 151, and Thunderbird 140.11.Show less
CVE-2026-8973
1Mozilla
2Firefox
Thunderbird
Oct 21, 2026
May 19, 2026
N/A· v4
8.8 HIGH· v3
N/A· v2
Memory safety bugs present in Thunderbird 150. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerabil...Show more
Memory safety bugs present in Thunderbird 150. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability was fixed in Firefox 151 and Thunderbird 151.Show less
CVE-2026-8972
1Mozilla
2Firefox
Thunderbird
Jul 23, 2026
May 19, 2026
N/A· v4
8.8 HIGH· v3
N/A· v2
Privilege escalation in the WebRTC: Audio/Video component. This vulnerability was fixed in Firefox 151 and Thunderbird 151.
CVE-2026-8971
1Mozilla
2Firefox
Thunderbird
Jul 23, 2026
May 19, 2026
N/A· v4
6.5 MEDIUM· v3
N/A· v2
Same-origin policy bypass in the Networking: JAR component. This vulnerability was fixed in Firefox 151 and Thunderbird 151.
CVE-2026-8970
1Mozilla
2Firefox
Thunderbird
Jul 23, 2026
May 19, 2026
N/A· v4
8.8 HIGH· v3
N/A· v2
Privilege escalation in the Security component. This vulnerability was fixed in Firefox 151, Firefox ESR 140.11, Thunderbird 151, and Thunderbird 140.11.